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Listing of Claims : 

1. (Currently Amended) An automatic detecting method for detecting 
protocol nonconformity,, in a predetermined communication protocol 
Transmission Control Protocol/Internet Protocol (TCP/IP) , occurring in a 
communication between transmitting and receiving terminals that make at least 
one transmitting and receiving control process in accordance with a 
predetermined communication protocol TCP/IP , said method comprising: 

receiving at a network interface a packet transmitted or received in the 
communication between said transmitting and receiving terminals to transfer 
the packet for data retention! UL if it is necessary to save the packet, and to 
transfer the packet for packet analysis, unless it is necessary to save the packet; 

analyzing header information of the packet transferred from the receiving 
to transfer the header information and necessary payload information; 

creating state information, which is Transmi s sion Control Protocol (TCP) 
TCP [[.]] connection information regarding a state of transmitting or receiving 
the packet to correspond to a result of transmitting and receiving control in 
accordance with said communication protocol, based on the header information 
and the payload information transferred from the analyzing; 

estimating normal information of a case where the transmitting and 
receiving control process is normally performed with the header information and 
the payload information received from the creating; 

storing beforehand nonconformity information featuring nonconformity in 
the transmitting and receiving control process^ the nonconformity information 
being any one of a conditional formula regarding the TCP connection 
information, a conditional formula regarding the header information of the 
packet, and a combination thereof; and 

comparing the analysis result of the analyzing, the TCP connection 
information created by the creating, the normal information estimated by the 
estimating, and the nonconformity information stored by the storing to detect the 
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transmitting and receiving control process where said nonconformity has 
occurred. 

2.-3. (Cancelled) 

4. (Currently Amended) The automatic detecting method fe^ according to 
claim 1, wherein the step of calculating creating further comprises updating said 
state information every time acquiring the packet, and the step of comparing 
further comprises comparing the latest state information updated at the step of 
calculating creating and said nonconformity information. 

5. (Currently Amended) The automatic detecting method fe* according to 
claim 1, wherein the TCP connection information includes an evaluation value 
having at least one of a total number of transmitted packets, a total number of 
retransmitted packets, a total number of Selective ACKnowledgement (SACK) 
blocks, a minimum packet size, a throughput of a maximum retransmitted 
interval, and a round trip time up to receiving a response packet to the 
transmitted packet. 

6. (Currently Amended) An automatic detecting apparatus for detecting 
protocol nonconformity^ in a predetermined communication protocol 
Transmission Control Protocol/Internet Protocol (TCP/IP) , occurring in a 
communication between transmitting and receiving terminals that make at least 
one transmitting and receiving control process in accordance with a 
predetermined communication protocol TCP/IP , said apparatus comprising: 

a packet receiving portion that receives at a network interface a packet 
transmitted or received in the communication between said transmitting and 
receiving terminals to transfer the packet for data retentional^ if it is necessary 
to save the packet, and to transfer the packet for packet analysis, unless it is 
necessary to save the packet; 
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a packet filter/analysis portion that analyzed analyzes header information 
of the packet transferred from the packet receiving portion to transfer the header 
information and necessary payload information; 

a connection information calculating portion that creates state 
information, which is Transmission Control Protocol (TCP) [[.]] connection 
information regarding a state of transmitting or receiving the packet to 
correspond to a result of a transmitting and receiving control in accordance with 
said communication protocol^ based on the header information and the payload 
information transferred from the packet filter/analysis portion [[o]]; 

a normal information estimating portion that estimates normal 
information of a case where the transmitting and receiving control process is 
normally performed,, with the header information and the payload information 
received from the connection information calculating portion; 

a nonconformity information saying saving portion that stores beforehand 
nonconformity information featuring nonconformity in the transmitting and 
receiving control process, the nonconformity information being any one of a 
conditional formula regarding the TCP connection information, a conditional 
formula regarding the header information of the packet, and a combination 
thereof; and 

a nonconformity comparison determining portion that compares the 
analysis result of the packet filter/analysis portion, the TCP connection 
information created by the connection information calculating portion, the 
normal information estimated by the normal information estimating portion, and 
the nonconformity information stored in the nonconformity information saying 
saving portion to detect the transmitting and receiving control process where 
said nonconformity has occurred. 

7.-8. (Cancelled) 
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9. (Previously Presented) The automatic detecting apparatus according to 
claim 6, wherein the TCP connection information includes an evaluation value 
having at least one of a total number of transmitted packets, a total number of 
retransmitted packets, a total number of Selective ACKnowledgement (SACK) 
blocks, a minimum pagket size, a throughput of a maximum retransmitted 
interval, and a round trip time up to receiving a response packet to the 
transmitted packet. 
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